Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package jetty-minimal for openSUSE:Factory checked in at 2026-09-17 15:23:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/jetty-minimal (Old) and /work/SRC/openSUSE:Factory/.jetty-minimal.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jetty-minimal" Thu Sep 17 15:23:53 2026 rev:34 rq:1378421 version:9.4.58 Changes: -------- +++ only whitespace diff in changes, re-diffing jetty-http2.changes: same change --- /work/SRC/openSUSE:Factory/jetty-minimal/jetty-minimal.changes 2026-08-13 13:17:05.188723842 +0200 +++ /work/SRC/openSUSE:Factory/.jetty-minimal.new.383539/jetty-minimal.changes 2026-09-17 15:23:55.877332661 +0200 @@ -1,0 +2,8 @@ +Wed Sep 16 15:51:50 UTC 2026 - Fridrich Strba <[email protected]> + +- Added patch: + * jetty-CVE-2026-12611.patch + + backport of upstream patch fixing bsc#1280034 + (CVE-2026-12611): Threads blocked in reset HTTP/2 requests + +------------------------------------------------------------------- +++ only whitespace diff in changes, re-diffing jetty-websocket.changes: same change New: ---- jetty-CVE-2026-12611.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.jetty-minimal.new.383539/jetty-minimal.changes-- Added patch: /work/SRC/openSUSE:Factory/.jetty-minimal.new.383539/jetty-minimal.changes: * jetty-CVE-2026-12611.patch /work/SRC/openSUSE:Factory/.jetty-minimal.new.383539/jetty-minimal.changes- + backport of upstream patch fixing bsc#1280034 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ jetty-http2.spec: same change ++++++ jetty-minimal.spec ++++++ --- /var/tmp/diff_new_pack.ZsAmg3/_old 2026-09-17 15:23:57.805413593 +0200 +++ /var/tmp/diff_new_pack.ZsAmg3/_new 2026-09-17 15:23:57.808413719 +0200 @@ -33,6 +33,7 @@ Patch2: jetty-CVE-2026-2332.patch Patch3: jetty-CVE-2026-5795.patch Patch4: jetty-CVE-2026-10050.patch +Patch5: jetty-CVE-2026-12611.patch BuildRequires: fdupes BuildRequires: java-devel >= 1.8 BuildRequires: maven-local jetty-websocket.spec: same change ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.ZsAmg3/_old 2026-09-17 15:23:57.894417329 +0200 +++ /var/tmp/diff_new_pack.ZsAmg3/_new 2026-09-17 15:23:57.897417455 +0200 @@ -1,6 +1,6 @@ -mtime: 1786540068 -commit: 1288a8f44d7f9c9ee8ab4c696eaca9ffac8a916daca520fd2ca5777dc092a02f +mtime: 1789574140 +commit: dc25c531df2e369036f5e47500936b72a55c3025707a4dcf478a56ed1acd3a43 url: https://src.opensuse.org/java-packages/jetty-minimal -revision: 1288a8f44d7f9c9ee8ab4c696eaca9ffac8a916daca520fd2ca5777dc092a02f +revision: dc25c531df2e369036f5e47500936b72a55c3025707a4dcf478a56ed1acd3a43 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-16 17:55:40.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ jetty-CVE-2026-12611.patch ++++++ >From 184d57dc5c8d27df86a04caa48e717c8ecb78798 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <[email protected]> Date: Wed, 16 Sep 2026 17:46:38 +0200 Subject: [PATCH] CVE-2026-12611 --- .../org/eclipse/jetty/http2/HTTP2Flusher.java | 53 ++++++++++++------- .../org/eclipse/jetty/http2/HTTP2Session.java | 2 +- .../org/eclipse/jetty/io/WriteFlusher.java | 12 ++--- 3 files changed, 38 insertions(+), 29 deletions(-) diff --git a/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Flusher.java b/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Flusher.java index e8170bd76b0..bdc1f53f37e 100644 --- a/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Flusher.java +++ b/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Flusher.java @@ -94,7 +94,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { entries.offerFirst(entry); if (LOG.isDebugEnabled()) - LOG.debug("Prepended {}, entries={}", entry, entries.size()); + LOG.debug("Prepended {}, entries={} on {}", entry, entries.size(), this); } } if (closed == null) @@ -113,7 +113,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { entries.offer(entry); if (LOG.isDebugEnabled()) - LOG.debug("Appended {}, entries={}", entry, entries.size()); + LOG.debug("Appended {}, entries={} on {}", entry, entries.size(), this); } } if (closed == null) @@ -132,7 +132,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { list.forEach(entries::offer); if (LOG.isDebugEnabled()) - LOG.debug("Appended {}, entries={}", list, entries.size()); + LOG.debug("Appended {}, entries={} on {}", list, entries.size(), this); } } if (closed == null) @@ -184,7 +184,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable if (pendingEntries.isEmpty()) { if (LOG.isDebugEnabled()) - LOG.debug("Flushed {}", session); + LOG.debug("Flushed {} on {}", session, this); return Action.IDLE; } @@ -200,14 +200,14 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { Entry entry = pending.next(); if (LOG.isDebugEnabled()) - LOG.debug("Processing {}", entry); + LOG.debug("Processing {} on {}", entry, this); // If the stream has been reset or removed, // don't send the frame and fail it here. if (entry.shouldBeDropped()) { if (LOG.isDebugEnabled()) - LOG.debug("Dropped {}", entry); + LOG.debug("Dropped {} on {}", entry, this); entry.failed(new EofException("dropped")); pending.remove(); continue; @@ -218,7 +218,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable if (entry.generate(lease)) { if (LOG.isDebugEnabled()) - LOG.debug("Generated {} frame bytes for {}", entry.getFrameBytesGenerated(), entry); + LOG.debug("Generated {} frame bytes for {} on {}", entry.getFrameBytesGenerated(), entry, this); progress = true; @@ -239,7 +239,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { stalledEntry = entry; if (LOG.isDebugEnabled()) - LOG.debug("Flow control stalled at {}", entry); + LOG.debug("Flow control stalled at {} on {}", entry, this); // Continue to process control frames. } } @@ -247,7 +247,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable catch (HpackException.StreamException failure) { if (LOG.isDebugEnabled()) - LOG.debug("Failure generating " + entry, failure); + LOG.debug("Failure generating {} on {}", entry, this, failure); entry.failed(failure); pending.remove(); } @@ -255,7 +255,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable { // Failure to generate the entry is catastrophic. if (LOG.isDebugEnabled()) - LOG.debug("Failure generating " + entry, failure); + LOG.debug("Failure generating {} on {}", entry, this, failure); failed(failure); return Action.SUCCEEDED; } @@ -271,7 +271,7 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable if (lease.getTotalLength() >= writeThreshold) { if (LOG.isDebugEnabled()) - LOG.debug("Write threshold {} exceeded", writeThreshold); + LOG.debug("Write threshold {} exceeded on {}", writeThreshold, this); break; } } @@ -284,13 +284,14 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable } if (LOG.isDebugEnabled()) - LOG.debug("Writing {} buffers ({} bytes) - entries processed/pending {}/{}: {}/{}", + LOG.debug("Writing {} buffers ({} bytes) - entries processed/pending {}/{}: {}/{} on {}", byteBuffers.size(), lease.getTotalLength(), processedEntries.size(), pendingEntries.size(), processedEntries, - pendingEntries); + pendingEntries, + this); session.getEndPoint().write(this, byteBuffers.toArray(EMPTY_BYTE_BUFFERS)); return Action.SCHEDULED; @@ -309,12 +310,13 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable public void succeeded() { if (LOG.isDebugEnabled()) - LOG.debug("Written {} buffers - entries processed/pending {}/{}: {}/{}", + LOG.debug("Written {} buffers - entries processed/pending {}/{}: {}/{} on {}", lease.getByteBuffers().size(), processedEntries.size(), pendingEntries.size(), processedEntries, - pendingEntries); + pendingEntries, + this); finish(); super.succeeded(); } @@ -358,13 +360,14 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable synchronized (this) { closed = terminated; - terminated = x; + terminated = combine(terminated, x); if (LOG.isDebugEnabled()) - LOG.debug(String.format("%s, entries processed/pending/queued=%d/%d/%d", + LOG.debug(String.format("%s, entries processed/pending/queued=%d/%d/%d on %s", closed != null ? "Closing" : "Failing", processedEntries.size(), pendingEntries.size(), - entries.size()), x); + entries.size(), + this), x); allEntries = new HashSet<>(entries); entries.clear(); } @@ -387,14 +390,24 @@ public class HTTP2Flusher extends IteratingCallback implements Dumpable synchronized (this) { closed = terminated; - terminated = cause; + terminated = combine(terminated, cause); if (LOG.isDebugEnabled()) - LOG.debug("{} {}", closed != null ? "Terminated" : "Terminating", this); + LOG.debug("{} on {}", closed != null ? "Terminated" : "Terminating", this); } if (closed == null) iterate(); } + private Throwable combine(Throwable existing, Throwable next) + { + if (existing == null) + return next; + if (next == null || existing == next) + return existing; + existing.addSuppressed(next); + return existing; + } + private void closed(Entry entry, Throwable failure) { entry.failed(failure); diff --git a/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java b/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java index 7560708d11b..443f0470ae1 100644 --- a/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java +++ b/jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java @@ -2076,7 +2076,7 @@ public abstract class HTTP2Session extends ContainerLifeCycle implements ISessio { if (LOG.isDebugEnabled()) LOG.debug("Terminating {}", HTTP2Session.this); - HTTP2Session.this.terminate(failure); + HTTP2Session.this.terminate(failure != null ? failure : new ClosedChannelException()); notifyClose(HTTP2Session.this, frame, Callback.NOOP); } diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java b/jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java index bc689270b6d..67dde7c4fc5 100644 --- a/jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java +++ b/jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java @@ -297,7 +297,7 @@ public abstract class WriteFlusher catch (Throwable e) { if (DEBUG) - LOG.debug("write exception", e); + LOG.debug("write exception {}", this, e); if (updateState(__WRITING, new FailedState(e))) callback.failed(e); else @@ -323,10 +323,6 @@ public abstract class WriteFlusher } case IDLE: - for (Throwable t : suppressed) - { - LOG.warn(t); - } return; default: @@ -380,7 +376,7 @@ public abstract class WriteFlusher if (buffers != null) { if (DEBUG) - LOG.debug("flushed incomplete {}", BufferUtil.toDetailString(buffers)); + LOG.debug("flushed incomplete {} {}", BufferUtil.toDetailString(buffers), this); if (buffers != pending.getBuffers()) pending = new PendingState(buffers, callback); if (updateState(__COMPLETING, pending)) @@ -398,7 +394,7 @@ public abstract class WriteFlusher catch (Throwable e) { if (DEBUG) - LOG.debug("completeWrite exception", e); + LOG.debug("completeWrite exception {}", this, e); if (updateState(__COMPLETING, new FailedState(e))) callback.failed(e); else @@ -487,7 +483,7 @@ public abstract class WriteFlusher case IDLE: case FAILED: if (DEBUG) - LOG.debug("ignored: " + this, cause); + LOG.debug("IGNORED {}", this, cause); return false; case PENDING: -- 2.55.0
